中考真题检索

搜索并下载全国各地中考真题试卷。触发词：中考真题、中考试卷、中考英语、中考数学、中考语文、中考物理、中考化学、真题下载、历年中考、中考备考、中考复习、湖南中考、长沙中考、北京中考、上海中考、各省中考真题下载

This package appears to implement the advertised search/download/verify workflow, but proceed carefully: - Major technical concern: download.py disables TLS certificate verification (ctx.check_hostname=False; ctx.verify_mode=ssl.CERT_NONE). This makes HTTPS connections vulnerable to MitM and could cause the script to download tampered or malicious files. Before running, remove the bypass so certs are validated, or explicitly document and accept the risk in a secure environment. - Only download and open files from trusted sources. The scripts can fetch arbitrary URLs and write them to disk; a malicious or mistyped URL can deliver executable, archive, or malicious content. - Run first-time runs in a sandboxed environment (VM/container) and inspect downloaded files before opening. Verify.py helps, but it is not a substitute for safe handling of untrusted binaries/archives. - If you will upload materials to an external knowledge base (IMA) or use other search skills, confirm their credential and privacy implications separately—this skill references those workflows but does not provide the integration code. - If you expect to handle RAR files, install unar from a trusted package manager. Avoid running unknown extraction tools from untrusted sources. - Recommended quick code changes: in download.py remove or change the SSL context lines so verification is enabled (use default SSL context without forcing verify_mode=ssl.CERT_NONE and keep check_hostname=True). Consider adding a safelist of allowed hostnames (e.g., files.eduuu.com, zhongkao.com) if you only intend to fetch from known domains. - Legal/ethical note: ensure you have the right to download and redistribute exam materials in your jurisdiction and organization. Given the TLS bypass and the network/file-write behavior, treat this skill as potentially risky until you patch the cert validation and run it in a controlled environment.

Type: OpenClaw Skill Name: zhongkao-exam-search Version: 1.0.0 The skill bundle contains functional scripts for searching and downloading exam papers but includes significant security vulnerabilities. Specifically, `scripts/download.py` explicitly disables SSL certificate verification (`ssl.CERT_NONE`), which exposes the system to Man-in-the-Middle (MITM) attacks. Additionally, the download script lacks input sanitization for the output file path, potentially allowing path traversal. While these flaws appear to be unintentional bugs or 'lazy' coding rather than intentional malice, they represent high-risk behaviors that warrant a suspicious classification according to the security threshold.